Conversations with a Bulletproof Hoster

Criminal commerce on the Internet would mostly grind to a halt were it not for the protection offered by so-called â€œbulletproof hostingâ€ providers â€“ the online equivalent of offshore havens where shady dealings go ignored. Last month I had an opportunity to interview a provider of bulletproof services for one of the Webâ€™s most notorious cybercrime forums, and who appears to have been at least partly responsible for launching whatâ€™s been called the largest cyber attack the Internet has ever seen.

Earlier this year, the closely-guarded English-language crime forum darkode.com was compromised and came under a series of heavy distributed denial-of-service (DDoS) attacks aimed at keeping it offline. Around that same time, darkode.com welcomed a new member â€” a bulletproof hosting broker aptly named â€œOff-sho.reâ€ â€” who promised to defend the site from future DDoS attacks.

Off-sho.re also said he could offer more robust and crime-friendly hosting services than darkodeâ€™s previous provider â€” Santrex, literally an offshore hosting facility located in the Seychelles, a 115-island country that spans an archipelago in the Indian Ocean. Off-sho.reâ€™s timing was perfect: Darkode desperately needed both, and Off-sho.re seemed to know his stuff, so he was admitted to the forum and given stewardship of the siteâ€™s defense and hosting.

STOPHAUS V. SPAMHAUS

Of course, to successfully defend a network against DDoS attacks one must know a great deal about how to launch such assaults. Indeed, Off-sho.re was an integral member of Stophaus, an upstart group of bulletproof hosters that banded together in March to launch a massive Internet attack against anti-spam group Spamhaus.org.

Hundreds of ISPs route or deny traffic based in part on Spamhausâ€™s blacklists of known, cybercrime-friendly ISPs, and Stophaus formed in response to Spamhausâ€™s listing of bulletproof hosting provider in particular: A network known alternatively as CB3ROB, a.k.a. â€œCyberbunkerâ€ because it operated from a heavily fortified NATO bunker in The Netherlands.

Off-sho.re is moderator of the Stophaus forum, and not long after joining darkode.com, he was recruiting fellow darkode members for the Stophaus cause. Stophausâ€™s records show that another core member was â€œ0ptik,â€ a competing bulletproof hosting provider. Spamhaus had listed dozens of Optikâ€™s domains, as well as virtually all of the IP address ranges Off-sho.re had rented at abuse-friendly Romanian hosting provider Voxility. It was payback time.

In late March, Spamhaus became the target of what experts called one of the largest computer attacks on the Internet. The method of attack â€” a DNS amplification attack â€” was similar to that first seen used in attacks more than a decade ago that targeted the heart of the Internetâ€™s routing system, except that it was by most accounts much larger.

â€œDNS amplification attacks can bring up to 140 Gbps to a single resource from a single controller,â€ Off-sho.re wrote in a darkode.com posting less than 24 hours after the attack on Spamhaus began. â€œThe beauty of it [is] that the â€˜botsâ€™ are just open DNS resolvers in the world.â€ Linking to a writeup from Cloudflare.com about the attack, Off-sho.re stated that â€œSome BP hosters were lately united, check out our latest prank.â€

Last month, authorities in Spain arrested Sven Kamphuis, a 35-year-old Dutch man, thought to be responsible for coordinating the unprecedented attack on Spamhaus. According to Spamhaus, Kamphuis made claims about being his own independent country in the Republic of Cyberbunker. But according to Off-Sho.re, Kamphuis was just the public face of the movement. â€œSven didnâ€™t attack anyone,â€ Off-Sho.re wrote in an online chat with KrebsOnSecurity.

If Kamphuis was just a mouthpiece, who was responsible for the attack? What is interesting about the Stophaus movement is that Off-sho.re very well may have prompted Spamhaus to finally place CB3ROB/Cyberbunker at the top of its Worldâ€™s Worst Spam-Support ISPs list, a move that helped to precipitate this conflict.

According to Spamhaus, while Cyberbunker and Spamhaus certainly have a bit of a history together, Cyberbunker wasnâ€™t really a focus of Spamhausâ€™s blocking efforts until the fall of 2012. Thatâ€™s when Spamhaus began noticing a large number of malware and botnet control servers being stood up inside of Cyberbunkerâ€™s Internet address ranges.

â€œWe didnâ€™t really notice these guys at CB3ROB much until last fall, when they started hosting botnet controllers, malware droppers and a lot of pharma spam stuff,â€ said a Spamhaus member who would only give his name as â€œBarry.â€ â€œBefore that, it was mainly routing for some Chinese guys â€“ Vincent Chan â€“ fake Chinese products.â€

Oddly enough, this coincides with Off-sho.reâ€™s entrance on the bulletproof hosting scene (at least as advertised on crime forums). In his introduction post to Darkode, Off-sho.re referenced his bulletproof hosting sales threads at two Russian-language forums â€” expoit.in and damagelab.org. In these threads, which began in Sept. 2012, Off-sho.re advertised the ability to host ZeuS and SpyEye botnet command and control networks for between $99 and $199 per month, and bulletproof domain registration from $30 per month. More importantly, Off-sho.re proudly announced that he was offering a premiere BP hosting service for $400 a month that was housed in an old NATO bunker in Holland and that used IP addresses assigned to CB3ROB (see screenshot to left).

CRUELTY-FREE CYBERATTACKS?

The attack that hit Spamhaus â€” known as a DNS reflection and amplification attack â€” leveraged unmanaged DNS servers on the Web to create huge traffic floods. DNS servers act as the white pages of the Internet, transforming or â€œresolvingâ€ human-friendly domain names into numerical network addresses used by computers. Typically, DNS servers only provide services to machines within a trusted domain. But DNS reflection attacks rely on consumer and business routers equipped with DNS servers that are (mis)configured to accept queries from anywhere on the Web. Attackers can send spoofed DNS queries to these so-called â€œopen recursiveâ€ DNS servers, forging the request so that it appears to come from the targetâ€™s network. That way, when the DNS servers respond, they reply to the spoofed (target) address.

The amplification part of the attack takes advantage of the ability to craft DNS queries so that the responses are much bigger than the requests; they do this by leveraging an extension to the DNS protocol that enables large DNS messages. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This â€œamplificationâ€ effect is especially pronounced if the perpetrators query dozens of DNS servers with these spoofed requests simultaneously.

I reached out to Off-sho.re via instant message to ask why he thought it was okay to hijack servers that belonged to someone else for use in attacks on third-parties.

â€œNo one launched or abused any attack, all DNS resolvers were machines that had this option open,â€ Off-sho.re explained. â€œNo bots were used and no one was infected. The individuals who did the attack, didnâ€™t harm any computer in order to launch it. So your question about the legal aspect of this thing is not relevant.â€

Rodney Joffe, vice president and senior technologist at Neustar, a Sterling, Va. based security company that helps firms defend against large cyberattacks, said such attitudes are common criminal delusion.

â€œThatâ€™s like saying, hey, all I did was open the car door, put a brick on the gas pedal and let the car run down the road and smash into someoneâ€™s house, but the guy who owned the car shouldnâ€™t have left it unlocked.

â€œIf you want real world analogues you can say, hey, that car was left open so I broke into it,â€ Joffe said. â€œThatâ€™s like saying, hey, all I did was open the car door, put a brick on the gas pedal and let the car run down the road and smash into someoneâ€™s house, but the guy who owned the car shouldnâ€™t have left it unlocked. Put another way, just because I have a non-functioning lock on my door doesnâ€™t give you permission to use my property.â€

NOTHING PERSONAL

Off-sho.re insisted he did not directly participate in launching the attacks on Spamhaus. But as I discovered in my reporting, he had no qualms about ordering his minions to attack my site prior to our chat conversation. A few days before I reached out to him, Off-sho.re orchestrated an attack against KrebsOnSecurity.com as a means of vetting a new darkode.com member.

That assault was part of the initiation process for â€œAbscond,â€ a hacker who was seeking admittance to darkode.com and whoâ€™d claimed his specialty was providing DDoS services. To prove his firepower, Abscond was told to knock one of three sites offline: Darkode.com, krebsonsecurity.com, or xylibox.com (the blog for a French security researcher who goes by the pseudonym â€œXylitolâ€). The conversation below took place between Off-sho.re and Abscond after the latterâ€™s botnet failed to bring down Darkode.com.

By the way, â€œstress testingâ€ is the new euphemism for launching DDoS attacks. If you arenâ€™t yet familiar with this term as it relates to online attacks, see DDoS Services Advertise Openly, Take PayPal, and Ragebooter: â€˜Legitâ€™ DDoS Service, or Fed Backdoor?

Off-sho.reâ€™s attitudes about ownership and whatâ€™s legal and acceptable online seems common in denizens of groups like Stophaus and other grey- and black-hat hacking collectives: that if something can be done then it is must be legal, allowable and otherwise okay. The governing mantra of these folks seems to be, â€œwhatâ€™s-mine-is-mine and whatâ€™s-your-is-mine, too.â€

wow that was a great article!! thanks for sharing...haah thats hilarious, that guy tried saying he didnt do anything wrong!! what the fuck was he smoking!?!? isn't it amazing how some people spend so much energy into being a parasite to society and the same energy could be used towards running a legit and successful business! that guy knows a shit load about computers, he could help so many people solve problems, but instead he just waists the talent!